ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “Active Directory”

19 stories in the last 7d

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllExploit / PoC 25Malware 18Threat actor 17Vulnerability 10Research 9Phishing & fraud 5Industry 4Advisory 4AI safety & security 3Tools 3Data breach 1AI tools & infra 1AI industry 1
SeverityAllcritical 12high 44medium 24low 1info 20

CISA Shares 17 Techniques Used by Hackers to Compromise Active Directory

CISA and five international agencies publish joint guidance detailing 17 techniques attackers use to compromise Microsoft Active Directory environments.

CISA, NSA, and the Australian Signals Directorate's ACSC, with contributions from Canadian, UK, and New Zealand cyber centers, released technical guidance on 17 Active Directory attack techniques. It covers AD Domain Services, AD Certificate Services, and AD Federation Services, including Kerberoasting, DCSync, Golden Ticket, Golden SAML, Skeleton Key, and Shadow Credentials. The guidance recommends treating domain controllers, CAs, AD FS servers, and Entra Connect systems as Tier 0 assets with phishing-resistant MFA, Kerberos pre-authentication enforcement, and disabling NTLM/SMBv1.

Cyber Security News · 1d agoAdvisory

Hackers Pose as Domain Controllers to Steal Active Directory Password Hashes

Attackers abuse Active Directory replication (DCSync) via the DRSUAPI protocol to steal password hashes and forge Golden Tickets for persistent domain compromise.

Security reporting citing Trellix details how threat actors impersonate domain controllers to request replication data and obtain NTLM password hashes without dumping LSASS on the domain controller. With Domain Admin or replication rights, attackers can steal the KRBTGT hash and forge long-lived Golden Tickets that survive password resets. Defenders should monitor DRSUAPI requests from non-DC systems, restrict replication permissions, and enforce MFA and tiered administrative access.

Cyber Security Newsupdated · 6d agofirst · 6d agoResearch 2 sources3· 1 read

CISA Warns Hackers Exploit 17 Active Directory Techniques to Gain Control of Enterprise Networks

CISA and Five Eyes agencies issued joint guidance detailing 17 Active Directory attack techniques like Kerberoasting and DCSync, with hardening and detection advice.

CISA, the NSA, and cyber agencies from Australia, Canada, the UK, and New Zealand released joint guidance on September 15 covering 17 techniques attackers use to compromise Active Directory, including AD CS, Certificate Services, and Federation Services attacks. Named techniques include Kerberoasting, AS-REP roasting, password spraying, DCSync, NTDS.dit dumping, Golden and Silver Tickets, Golden SAML, and Skeleton Key. Recommendations include minimizing SPN accounts, enforcing AES encryption, disabling NTLM, account lockout thresholds of five attempts, phishing-resistant MFA, and Tier 0 prioritization. The guide also lists Windows event IDs 4769, 4768, 4625, 4771, and 2889 for detecting Kerberoasting and password spraying on domain controllers.

GBHackers · 1d agoAdvisory

Weekly Cybersecurity Newsletter – Top 50 Biggest Cybersecurity Stories of the Week

GBHackers weekly digest rounds up 50 stories including Microsoft's 973-CVE patch drop, exploited Cisco FMC flaws, and Claude agent attacks.

GBHackers' September 7-12, 2026 newsletter summarizes the 50 biggest cybersecurity stories of the week. Highlights include Microsoft patching a record 973 CVEs with two exploited zero-days, active exploitation of Cisco FMC, Check Point VPN and Ivanti flaws, China-linked crews chaining Chrome and Windows zero-days, AI agents mass-exploiting PaperCut to compromise 440 servers, and the emergence of Panzer cross-platform ransomware. It also covers Anthropic and OpenAI agentic AI incidents and CrowdStrike's SafeMind launch.

GBHackers · 1d agoIndustry in the wild

eBook: Identity-First Threat Intelligence

Enzoic promotes an eBook on identity-first threat intelligence addressing infostealer-driven credential exposure across AD and IAM.

Help Net Security promotes an Enzoic eBook on identity-first threat intelligence. It covers how infostealer malware accelerates credential theft, why password reuse turns consumer breaches into enterprise risk, and where traditional IAM and Active Directory protections fall short. The eBook advocates real-time credential intelligence from Dark Web monitoring for earlier exposure detection and automated response.

Help Net Security · 1d agoIndustry

12 Best Endpoint Privilege Management (EPM) Tools Compared (2026): Features & Pricing

A 2026 buyer's guide compares 12 endpoint privilege management tools, ranking CyberArk and BeyondTrust as enterprise leaders.

An editorial comparison evaluates 12 endpoint privilege management (EPM) tools on elevation control, manageability, and pricing model. The guide argues that standing local-admin rights fuel ransomware and lateral movement, making their removal a high-impact control that cyber insurers increasingly mandate. CyberArk and BeyondTrust are positioned as enterprise-depth leaders, with Delinea, Heimdal, and ManageEngine for the mid-market, and Admin By Request and CyberFOX AutoElevate for SMBs and MSPs. Pricing is generally per endpoint or per user, and the article is explicitly an assessment rather than a product release or incident report.

GBHackersupdated · 21h agofirst · 6d agoIndustry 14 sources

Most Firms Unable to Recover Quickly from Ransomware

Fenix24's first State of Recoverability report finds only 0.5% of 800+ ransomware clients neared 24-48 hour recovery targets, with identity failures central.

Drawing on 500+ ransomware recoveries, Fenix24 found only four of 800+ clients (0.5%) came close to their own 24-48 hour recovery targets, and none reached full operations for weeks. 99.2% lacked a documented identity recovery plan, Active Directory typically fell first, and 94% tied backup systems to the compromised directory. In 38% of engagements backups survived but could not carry recovery; storage ran short in 82% of cases and 95% lacked meaningful MFA on critical infrastructure consoles.

Infosecurity Magazine · 1d agoResearch

How Attackers Abuse VSS, and How Huntress Detects It

Huntress details how attackers abuse Windows Volume Shadow Copies for ransomware recovery sabotage and NTDS.dit credential theft, plus detection logic.

Huntress explains that attackers abuse VSS in three ways: deleting shadow copies to inhibit recovery before ransomware detonation, creating shadow copies to extract the NTDS.dit Active Directory database for offline credential theft, and manipulating shadow copy configuration. Because backup agents and RMM tools routinely create and delete shadow copies, raw events are too noisy to alert on alone. Huntress detections instead correlate VSS activity with lateral movement and credential harvesting over a time window, such as an observed sequence of PsExec spawning SYSTEM shells on a domain controller, vssadmin create shadow, a blocked deletion attempt, and DNS reconnaissance against another host.

Huntress · 2d agoResearch

Credential Theft: How Attackers Steal & Use Stolen Credentials

Huntress explains how attackers steal credentials through phishing, AitM, infostealers, and dumping, then use them for lateral movement, BEC, and ransomware.

Huntress published an educational overview of credential theft, citing that roughly 70% of confirmed data breaches begin with stolen credentials. It details acquisition methods including phishing, adversary-in-the-middle attacks that capture MFA session tokens, infostealers (nearly a quarter of threats Huntress observed in 2025), Mimikatz-based credential dumping, credential stuffing, and password spraying. The piece then covers post-theft actions such as lateral movement, privilege escalation, account takeover, business email compromise, and ransomware, and closes with behavioral detection guidance and layered prevention strategies.

Huntress · 6d agoResearch

CISA and NIST Issue Guidance to Protect Cloud Identity Tokens

CISA and NIST published Interagency Report 8587 with voluntary guidance to harden cloud identity tokens against theft, forgery, and lateral movement.

CISA and NIST released NIST Interagency Report 8587 on September 15 with final voluntary guidance for federal agencies, cloud providers, and their customers on protecting SSO, federation, and API tokens. Requirements include one-hour maximum token lifetimes, 90-day signing key rotation for high-impact systems, hardware-backed key storage, explicit audience fields, and keeping tokens out of logs. The guidance was motivated by the 2020 ADFS compromise where forged SAML assertions bypassed MFA, and an incident where a leaked consumer signing key enabled token forgery and theft of 60,000+ emails from one agency. Nearly 250 public comments shaped the text, with input from Google, Microsoft, Okta, AWS, Oracle, IBM, HashiCorp, Wiz, and the OpenID Foundation via the Joint Cyber Defense Collaborative.

Infosecurity Magazine · 17h agoAdvisory

Linux Detection Engineering - Local Privilege Escalation

Elastic details a layered detection framework for Linux local privilege escalation, covering 2026's copy-on-write bug wave and LLM-assisted discovery.

Elastic Security Labs describes how most Linux local privilege escalations share a common host flow — an unprivileged process launched from a writable path becoming root — and proposes layered detections combining general outcome-based rules with per-technique rules in Elastic Defend and Auditd. It tracks 13 recent LPE disclosures, seven of which share a copy-on-write/zero-copy bug class, including Copy Fail, DirtyFrag, Fragnesia, DirtyDecrypt, DirtyClone, pedit COW, and RefluXFS. Qualys attributes RefluXFS to an LLM-assisted research effort with Anthropic using Claude Mythos Preview, and another bug is credited to an LLM-assisted workflow. Detection and endpoint rules are published in Elastic's detection-rules and protections-artifacts repositories.

Elastic Security Labs · 6d agoResearch1

When the Whole Company Adopts AI: What It Does to Your SOC

Analysis of 16.9 million SOC alerts finds AI-related alerts at 0.43%, growing 685% since February, with 94.1% noise and 0.02% real attacks.

A review of roughly 16.9 million SOC alerts found about 73,000 (0.43%) were AI-related, a share that grew 685% between February and June 2026. Of AI-related alerts, 94.1% were noise, 5.8% genuine risks, and 0.02% real attacks; 79.8% received benign verdicts, 81.7% were automatically suppressed, and only 5.4% reached a human analyst. The only confirmed attacks were phishing campaigns that weaponized AI brand names as lures, while developer coding agents spawning shells and reading credential stores routinely tripped detections written before AI agents existed.

The Hacker News · 4d agoResearch2

CISA and NIST Release Technical Checklist for Safeguarding Identity Tokens From Theft and Misuse

CISA and NIST published NIST IR 8587, final guidance for protecting identity tokens from forgery, theft, replay, and signing-key compromise.

NIST Interagency Report 8587 (September 15, 2026) expands the IA-13 'Identity Providers and Authorization Servers' control from NIST SP 800-53 R5.1.1, guiding federal agencies and cloud providers on SSO, identity federation, and machine-to-machine authentication. It requires hardware-backed signing-key storage for moderate-impact systems, 90-day key rotation for high-impact systems, token lifetimes under one hour, and sender-constrained mechanisms such as mutual TLS and DPoP. The report cites incidents including forged SAML assertions that exposed over 60,000 emails from a federal agency. It also extends guidance to agentic AI systems using signed tokens and urges post-quantum cryptography migration planning.

Cyber Security News · 1d agoAdvisory1

Now everyone can put data to work

OpenAI launched a Data agent in ChatGPT Work that connects to enterprise warehouses and builds shareable analysis dashboards without SQL.

OpenAI introduced a Data agent in ChatGPT Work that connects to approved sources including Snowflake, BigQuery, Databricks, Redshift, ClickHouse, MongoDB, and Datadog, plus files from Google Drive and SharePoint. It investigates metric changes, builds interactive dashboards, and integrates with BI tools such as Power BI, Tableau, Omni, Sigma, and ThoughtSpot using semantic layers from dbt, Databricks Genie Ontology, and Snowflake Horizon. Queries enforce the connected account's existing table, row, and column permissions, with administrators controlling access via Workspace settings. OpenAI says nearly all of its product team and over two-thirds of its GTM organization use it internally, and NTT Data, Thermo Fisher, and ServicePiston are Alpha customers.

OpenAI News · 6d agoAI industry

Homebrew 7.0.0 Adds Built-In Vulnerability Scanner and Stronger Package Sandboxing

Homebrew 7.0.0 ships a native brew vulns scanner, OSV-backed advisory database, stronger sandboxing, and fixes a sandbox-escape issue.

Homebrew 7.0.0 introduces a built-in 'brew vulns' command that scans installed formulae, dependencies, and Brewfiles against a new Homebrew-specific advisory database and OSV.dev data, distinguishing backported fixes from outdated versions. The release hardens sandboxing by blocking home-directory reads during builds, disabling network access at install time, and replacing Bubblewrap with Landlock on Linux. It also fixes moderate-severity GHSA-5263-whxq-77hp, where a malicious cask could execute code outside the macOS sandbox via LaunchServices, and drops macOS Catalina while moving Intel Macs to Tier 3.

Cyber Security News · 1d agoTools1

WordPress Uses AI to Stop Malicious Plugin Updates Before They Reach Millions of Websites

WordPress.org now auto-blocks plugin updates flagged by AI review after a backdoor incident, adding a supply-chain gate for millions of sites.

Since June 5, 2026, every WordPress.org plugin and theme release passes a mandatory six-hour cooldown while multiple AI models and Jetpack Scan analyze code changes and produce a consolidated security score; releases above the risk threshold are blocked automatically. The change followed a July 28, 2026 incident where a backdoor was pushed into a plugin with roughly 20,000 active installs, which Wordfence flagged and the Plugins Team pulled 26 minutes later before distribution. Authors are notified of blocking findings and can republish corrected releases or appeal false positives to the Plugins Team.

Cyber Security Newsupdated · 6d agofirst · 6d agoTools 3 sources1

WordPress Adds Automated Plugin Reviews to Block High-Risk Updates Before Distribution

WordPress will automatically scan every plugin release and block high-risk updates from distribution using AI analysis plus Jetpack Scan.

WordPress announced automated security reviews for every plugin release during its cooldown period before distribution through the WordPress.org update API, combining AI models with Jetpack Scan into a security score. The system already caught a backdoor committed to a plugin with about 20,000 active installations on July 28, 2026, blocking it within 26 minutes of a Wordfence alert. Flagged patterns include missing capability checks, unsafe $wpdb queries, unserialize() on request data, and obfuscated code.

The Hacker News · 2d agoTools

AWS Introduces Pizza Bot: An Open Source Inbox for Background AI Agents

AWS open-sourced Pizza Bot, a self-hosted inbox app for background AI agents with approval gating and multi-provider model support.

AWS released Pizza Bot under Apache 2.0 after earlier versions served over 2,000 Amazon employees for meeting prep, email drafting, and research. The app provides macOS, Windows, and Linux desktop builds plus browser and terminal clients talking to a Hono API server, with LangGraph/DeepAgents checkpoints preserving thread state and approval pauses. It supports Amazon Bedrock, Anthropic, Google Gemini, OpenAI, OpenRouter, and Ollama, exposes external tools via MCP servers, and lets skill authors gate actions behind approve/edit/reject flows.

MarkTechPost · 3d agoAI tools & infra1

The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE

Unit 42 demonstrates that root access on a Kubernetes node lets attackers spoof SPIFFE/SPIRE attestation and harvest co-located workloads' SVIDs.

Palo Alto Networks Unit 42 describes post-exploitation techniques in which an attacker with root on a compromised Kubernetes node spoofs Linux cgroup metadata used by the SPIRE agent during workload attestation, tricking it into issuing a co-located workload's SPIFFE Verifiable Identity Document to an attacker-controlled process. The research shows the core trust assumption of machine-identity systems—that the node is trusted—collapses once root is obtained, exposing all cryptographic identities scoped to that node. Unit 42 released an open-source tool, Spooffe, for defenders to test identity exposure, and notes the technique has not been observed exploited in the wild.

Palo Alto Unit 42 · 6d agoResearch1